Does Three Wi-Fi hotspot stuff extra ads into Web pages?

player00 · 29-02-2016, 00:33

Hi

I don't know if this is just something happening to me or someone else has noticed, but when I connect my PC to my the Three hotspost surfing the Internet is full of redirections and pop ups. I does only happen when I used the PC on the Three Wi-Fi, it does not happen when I connect the PC to the flat's Virgin Media Wi-Fi or when I surf the Internet from the mobile phone using Three.

I have tried different antiviruses and adware removers on the PC and the phone and nothing works. I have come to the conclusion that it might be the carrier itself inserting ads in the Wi-Fi hotspot. This would be quite worring because I have paid a plan including "All data you can eat", so I should not see these ads either surfing on the mobile or using it as a hotspot.

Does it happen to anybody else?

Cheers.

Gigabit · 29-02-2016, 08:10

No they don't.

Thine Wonk · 29-02-2016, 08:56

Agreed

player00 · 29-02-2016, 13:29

So, if it is an infection, what kind of malware is that? I have never seen something like that before. It is only polluting the hotspot, but not the regular navigation.

Can anyone advise a tool to clean it? I have tried Avast and Adwcleaner, two of the best, on the PC and they did not detect it. Also, I tried Avats and Malwarebytes on the phone and it is not detected either.

Help, please.

Thank you.

de525ma · 29-02-2016, 15:24

Quote:

Originally Posted by player00

So, if it is an infection, what kind of malware is that? I have never seen something like that before. It is only polluting the hotspot, but not the regular navigation.

Can anyone advise a tool to clean it? I have tried Avast and Adwcleaner, two of the best, on the PC and they did not detect it. Also, I tried Avats and Malwarebytes on the phone and it is not detected either.

Help, please.

Thank you.

Does it happen with all web browsers or just one?

Thine Wonk · 29-02-2016, 17:44

Sounds odd, even if the DNS servers had been changed that would apply to all wifi connections used on the device. Unless the DNS servers set on the phone / mifi are bad?

Check of proxy settings, bad DNS servers, bad browser plugins and other things OP.

player00 · 29-02-2016, 21:28

Thank you to both of you for trying to bring some light.

Cheers.

Quote:

Originally Posted by de525ma

Does it happen with all web browsers or just one?

It happens with all the browsers, I have recorded a screen cap video to explain it. I attach the link.

Rec005.avi

Virgin Media is my flat's Wi-Fi and AndroidAP is my phone. As you can see in the video, when I surf with Virgin Media everything is fine, but as soon as I change to the phone hotspot the redirections, pop-ups and banners at the bottom of the screen show up.

Quote:

Originally Posted by Thine Wonk

Sounds odd, even if the DNS servers had been changed that would apply to all wifi connections used on the device. Unless the DNS servers set on the phone / mifi are bad?

Check of proxy settings, bad DNS servers, bad browser plugins and other things OP.

I am using FireFox, I went to Options > Advance > Network > Connection > Set Up and I did not see anything weird. It is using the system proxy configuration. I checked the plugins but I have only seen Adobe, Java, Cisco, NVidia and Microsoft plugins.

There was one suspicious, Adobe Primetime, which was installed in a recent date. I went into the "read more" tap and followed the link, however, it linked to a genuine Adobe blog.

I don't understand what you want me to do with the DNS. It is a server side thing, linking the hosting and the domain.

mupet0000 · 29-02-2016, 21:51

Not sure what's causing you this issue but I'd just like to point out that the solidfiles website you hosted your video on tries really hard to get you to install some kind of spyware/malware. The download button tried to install a chrome extension, then it even downloaded a .zip file with the filename you gave, but inside was another zip file with a .exe.

You can actually download the file from solidfiles, there's a tiny bit of text that says "Direct download link" in the middle.

Next time, upload your video to YouTube as private.

Thine Wonk · 29-02-2016, 21:57

If you notice, just before you went to that ad the page smartnewtab came up.

I see that is malware / adware when you google it, it's a browser hijacker.

https://malwaretips.com/blogs/remove-smartnewtab-com/
http://www.virusresearch.org/remove-...me-firefox-ie/

I'd run a scan with Malwarebytes on the PC.

Depending on the results of that we might need more information about the phone and we might need to check those DNS settings, but initially I think the Malwarebytes PC scan is the best option.

player00 · 01-03-2016, 19:24

Quote:

Originally Posted by Thine Wonk

If you notice, just before you went to that ad the page smartnewtab came up.

I see that is malware / adware when you google it, it's a browser hijacker.

https://malwaretips.com/blogs/remove-smartnewtab-com/
http://www.virusresearch.org/remove-...me-firefox-ie/

I'd run a scan with Malwarebytes on the PC.

Depending on the results of that we might need more information about the phone and we might need to check those DNS settings, but initially I think the Malwarebytes PC scan is the best option.

Thank you, Thine Wonk.

You were right about the infection and the tool. It was a browser hijack in the PC.

What I don't understand, and what confused me, was that it only hijacked the browser when using the hotspot. It did not hijacked the browser when using the Wi-Fi.

Also, neither Avast nor AdwCleaner could detect it, and they are supposed to be some of the best tools for these cases.

It was a weird case that I hadn't seen before.

Thine Wonk · 01-03-2016, 19:30

I suppose it's possible that Virgin Media have blocked the IP of that bad site to protect customers or something, I can't explain that bit.

However that's good news, glad you got it sorted.

29-02-2016, 00:33	#1
player00 Forum Member Join Date: Dec 2011 Posts: 4	Does Three Wi-Fi hotspot stuff extra ads into Web pages? Hi I don't know if this is just something happening to me or someone else has noticed, but when I connect my PC to my the Three hotspost surfing the Internet is full of redirections and pop ups. I does only happen when I used the PC on the Three Wi-Fi, it does not happen when I connect the PC to the flat's Virgin Media Wi-Fi or when I surf the Internet from the mobile phone using Three. I have tried different antiviruses and adware removers on the PC and the phone and nothing works. I have come to the conclusion that it might be the carrier itself inserting ads in the Wi-Fi hotspot. This would be quite worring because I have paid a plan including "All data you can eat", so I should not see these ads either surfing on the mobile or using it as a hotspot. Does it happen to anybody else? Cheers.

29-02-2016, 08:10	#2
Gigabit Forum Member Join Date: Aug 2014 Location: United Kingdom Posts: 2,887	No they don't.

29-02-2016, 08:56	#3
Thine Wonk Forum Member Join Date: Mar 2009 Posts: 14,577	Agreed

29-02-2016, 13:29	#4
player00 Forum Member Join Date: Dec 2011 Posts: 4	So, if it is an infection, what kind of malware is that? I have never seen something like that before. It is only polluting the hotspot, but not the regular navigation. Can anyone advise a tool to clean it? I have tried Avast and Adwcleaner, two of the best, on the PC and they did not detect it. Also, I tried Avats and Malwarebytes on the phone and it is not detected either. Help, please. Thank you.

29-02-2016, 15:24	#5
de525ma Forum Member Join Date: Jan 2014 Location: Portsmouth Posts: 787	Quote: Originally Posted by player00 So, if it is an infection, what kind of malware is that? I have never seen something like that before. It is only polluting the hotspot, but not the regular navigation. Can anyone advise a tool to clean it? I have tried Avast and Adwcleaner, two of the best, on the PC and they did not detect it. Also, I tried Avats and Malwarebytes on the phone and it is not detected either. Help, please. Thank you. Does it happen with all web browsers or just one?

29-02-2016, 17:44	#6
Thine Wonk Forum Member Join Date: Mar 2009 Posts: 14,577	Sounds odd, even if the DNS servers had been changed that would apply to all wifi connections used on the device. Unless the DNS servers set on the phone / mifi are bad? Check of proxy settings, bad DNS servers, bad browser plugins and other things OP.

29-02-2016, 21:28	#7
player00 Forum Member Join Date: Dec 2011 Posts: 4	Thank you to both of you for trying to bring some light. Cheers. Quote: Originally Posted by de525ma Does it happen with all web browsers or just one? It happens with all the browsers, I have recorded a screen cap video to explain it. I attach the link. Rec005.avi Virgin Media is my flat's Wi-Fi and AndroidAP is my phone. As you can see in the video, when I surf with Virgin Media everything is fine, but as soon as I change to the phone hotspot the redirections, pop-ups and banners at the bottom of the screen show up. Quote: Originally Posted by Thine Wonk Sounds odd, even if the DNS servers had been changed that would apply to all wifi connections used on the device. Unless the DNS servers set on the phone / mifi are bad? Check of proxy settings, bad DNS servers, bad browser plugins and other things OP. I am using FireFox, I went to Options > Advance > Network > Connection > Set Up and I did not see anything weird. It is using the system proxy configuration. I checked the plugins but I have only seen Adobe, Java, Cisco, NVidia and Microsoft plugins. There was one suspicious, Adobe Primetime, which was installed in a recent date. I went into the "read more" tap and followed the link, however, it linked to a genuine Adobe blog. I don't understand what you want me to do with the DNS. It is a server side thing, linking the hosting and the domain.

29-02-2016, 21:51	#8
mupet0000 Forum Member Join Date: Sep 2007 Posts: 620	Not sure what's causing you this issue but I'd just like to point out that the solidfiles website you hosted your video on tries really hard to get you to install some kind of spyware/malware. The download button tried to install a chrome extension, then it even downloaded a .zip file with the filename you gave, but inside was another zip file with a .exe. You can actually download the file from solidfiles, there's a tiny bit of text that says "Direct download link" in the middle. Next time, upload your video to YouTube as private.

29-02-2016, 21:57	#9
Thine Wonk Forum Member Join Date: Mar 2009 Posts: 14,577	If you notice, just before you went to that ad the page smartnewtab came up. I see that is malware / adware when you google it, it's a browser hijacker. https://malwaretips.com/blogs/remove-smartnewtab-com/ http://www.virusresearch.org/remove-...me-firefox-ie/ I'd run a scan with Malwarebytes on the PC. Depending on the results of that we might need more information about the phone and we might need to check those DNS settings, but initially I think the Malwarebytes PC scan is the best option.

01-03-2016, 19:24	#10
player00 Forum Member Join Date: Dec 2011 Posts: 4	Quote: Originally Posted by Thine Wonk If you notice, just before you went to that ad the page smartnewtab came up. I see that is malware / adware when you google it, it's a browser hijacker. https://malwaretips.com/blogs/remove-smartnewtab-com/ http://www.virusresearch.org/remove-...me-firefox-ie/ I'd run a scan with Malwarebytes on the PC. Depending on the results of that we might need more information about the phone and we might need to check those DNS settings, but initially I think the Malwarebytes PC scan is the best option. Thank you, Thine Wonk. You were right about the infection and the tool. It was a browser hijack in the PC. What I don't understand, and what confused me, was that it only hijacked the browser when using the hotspot. It did not hijacked the browser when using the Wi-Fi. Also, neither Avast nor AdwCleaner could detect it, and they are supposed to be some of the best tools for these cases. It was a weird case that I hadn't seen before.

01-03-2016, 19:30	#11
Thine Wonk Forum Member Join Date: Mar 2009 Posts: 14,577	I suppose it's possible that Virgin Media have blocked the IP of that bad site to protect customers or something, I can't explain that bit. However that's good news, glad you got it sorted.

DS Forums

Does Three Wi-Fi hotspot stuff extra ads into Web pages?